Day 28 File System

File systems under Linux Virtual File System (VFS) Provides support for a variety of file management systems and file structures. Provides a single, uniform interface to all user processes.

Virtual File System Similar to UNIX in supporting In addition, Hierarchical directory structure Directories are treated like files (only the format of the contents of the data-blocks differ) i-nodes are used to describe directory entries. In addition, Files are considered objects that share basic properties regardless of the target file system. Files have symbolic names that allow them to be uniquely identified Have owners, protection against unauthorized access or modification … A mapping module is used to convert the attributes of the file in its native file system to the format of the VFS.

Object types in VFS Superblock object Stores information about the specific file system Device mounted on, pointer to root of the file system, basic block size, list of open files, list of superblock operations etc.

Object types in VFS The Inode Object Exists only in main memory. A cache of all accessed file and directory i-nodes is maintained. Holds the attributes of the directory entry File type, owner, size of data, number of datablocks

Object types in VFS Directory Entry Object (dentry) Exists only in main memory Held in a dcache (dentry cache) Constructed as directory entries are accessed from the various underlying file systems Maintained by the VFS for faster access.

Object types in VFS The File Object Represent a file(or directory) opened by a process. open(), close() operations Includes the following: Dentry object associated with the file. File system containing the file. File pointer

Accessing a file with VFS Check to see if a dentry for the file exists in the dcache. If yes, then find the i-node in the i-node cache and take appropriate action. If no, map the VFS system call to the system call of the file system that the file exists in. Access the file information from the file system, perform appropriate action and update the dcache and i-node cache. In some cases, this may involve having to actually construct the i-node for the dentry.

Ext3fs (Third extended file system) The de-facto Linux file system Supports basic UNIX operations and structure In addition, Supports long file names (upto 255 characters) Supports larger portion sizes (more than one sector) Faster symbolic links i.e. the path is stored in the i-node and does not occupy a block on the disk. Secure deletion of files (man shred) New types of files such as immutable files can be created (chattr +i filename) Journaling is enabled log of all file system changes is maintained in the event of a system crash can undo or redo actions based on the recorded actions in the log file The main difference between ext2fs and ext3fs

Windows File System File allocation table used in Windows 95, MS-DOS (FAT12, FAT16, FAT32) Windows file system (NTFS - New Technology File System ) used in Windows XP

Key features of NTFS NTFS uses clusters(rather than sectors) as units of disk allocation. Default cluster sizes: Sector size for volumes up to 512MB 1KB for volumes up to 1GB 2KB for volumes up to 2GB 4KB for larger volumes Uses logic cluster numbers as disk addresses. A file is a structured object that has attributes such as name, creation time, security (ACL), data attributes.

Key features of NTFS Security – Each file references a security descriptor Contains an access token for the owner Contains an ACL General indexing facility Can index file using different attributes e.g. size, date last created, name

Key features of NTFS Recoverability In the event of a crash, NTFS can reconstruct disk volumes to a consistent state. File system information can be retrieved, not necessarily the data in the files. Uses transaction processing, where a change is an atomic operation and the change is logged, when (successfully) completed.

Recoverability Log each transaction that modifies the volume Enter transaction in log file (cache) Perform action on volume (cache) Write log file to disk Write volume to disk In the event of a crash in the midst of a transaction, the log file can be used to redo or undo the transaction.

NTFS Volume Layout

NTFS metadata files Partition boot sector Maybe more than one sector. Holds the volume layout, file system structures, boot startup information and code, pointer to MFT(master File Table) and MFT2

NTFS volume layout The disk is partitioned into two zones Data-zone MFT-zone (Master File Table) About 22% of the sectors Allows for the MFT to be stored in contiguous locations and hence allows for faster access. If the data-zone runs out of space, then the space in the MFT-zone may be used. MFT may become fragmented. The standard de-fragmentation tool cannot de-fragment MFT. (Tools to de-fragment the MFT - Diskeeper, PerfectDisk and O&O Defrag )

NTFS Metadata Files NameMFT Record Description $MFT Master File Table—NTFS's command central $MFTMIRR 1 Copy of the first 16 records of the MFT $LOGFILE 2 Transactional logging file $VOLUME 3 Contains volume serial number, creation time, and dirty flag $ATTRDEF 4 Attribute definitions . 5 Root directory of the disk $BITMAP 6 Contains drive's cluster map (in-use vs. free) $BOOT 7 Boot record of the drive $BADCLUS 8 Lists bad clusters on the drive $QUOTA 9 Contains user quota information—unused before NT 5.0 NTFS Article from WindowsITPro by Mark Russinovich- Reference # 4

NTFS metadata files (occupy about 4MB) Master File Table A list of all the contents on the volume (including an entry for the MFT itself.) Table of variable length records. Each record is a file or a folder. Contains the set of attributes that define the file/folder. May contain the data of the file/folder if the data is small enough. Else contain pointers to clusters that hold the rest of the data for the file/folder. Contiguous allocation is used.

NTFS metadata files System files MFT2 Log file Cluster bit map A mirror of the first 16 records (i.e. the 11 metafiles) of the MFT, placed in the middle of the disk partition. Log file A list of the transactions used for recovery. Cluster bit map Attribute definition table Defines types of attributes supported Indicates whether they can be indexed. Indicated whether they can be recovered.